MCP tools show * instead of actual tool name in permission dialogs

Bug

When an MCP tool requests permission, the dialog shows * instead of the actual tool name.

Example

User has nextcloud MCP server configured with tools disabled globally: "nextcloud_*": false
Agent calls nextcloud_nc_webdav_delete_resource
Permission dialog shows: * as the permission name
Expected: Should show nextcloud_nc_webdav_delete_resource

Screenshot

User reports seeing just * in the permission prompt instead of the specific MCP tool name.

Root Cause

In packages/opencode/src/session/prompt.ts, the resolveTools function wraps MCP tool execution with permission handling that always uses patterns: ["*"]:

await ctx.ask({
  permission: key,
  metadata: {},
  patterns: ["*"],    // <-- Should be [key]
  always: ["*"],
})

Meanwhile, built-in tools like bash use specific patterns:

patterns.add(commandText)
always.add(BashArity.prefix(command).join(" ") + " *")

Expected Behavior

MCP tools should use their actual tool name as the permission pattern, similar to how built-in tools use specific patterns. This would allow users to:

See exactly which MCP tool is requesting permission
Make informed decisions about allowing/denying specific tools
Configure tool-specific permissions in agent frontmatter

Fix

Change the patterns to use the MCP tool name:

await ctx.ask({
  permission: key,
  metadata: {},
  patterns: [key],
  always: [key],
})

Environment

OpenCode version: 1.3.3
MCP server: nextcloud (and likely all MCP servers)

fix(session): use MCP tool name in permission patterns instead of wil…

This is particularly frustrating in the web/desktop UI where you can't see a preview of what args it's attempting to use.

Related tweet w/ screenshots: https://twitter.com/the_ross_man/status/2029944815010349392

fix(mcp): pass tool name and args to permission ask

test(mcp): assert permission ask payload from tool wrapper

fix(mcp): pass tool name and args to permission ask

test(mcp): assert permission ask payload from tool wrapper

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

Still reproducible on the current CLI build (opencode v1.17.11, macOS). This was closed by the stale-issue bot after 60 days of inactivity, not because it was resolved or rejected — both fix attempts (#24605, #32564) were themselves auto-closed by the PR-template-compliance bot within ~2 hours of opening, never on technical merit. Requesting this be reopened.

Root cause confirmed independently, by decompiling the shipped binary (strings on the standalone macOS build) and locating the generic MCP tool wrapper:

f.execute=(F,O)=>l.promise(h.gen(function*(){
  let i=Y(F,O);
  yield*d.trigger("tool.execute.before",{tool:r,sessionID:i.sessionID,callID:O.toolCallId},{args:F});
  let K=yield*h.gen(function*(){
    return yield*i.ask({permission:r,metadata:{},patterns:["*"],always:["*"]}),
    yield*h.promise(()=>k(F,O))
  })...

metadata:{} and patterns:["*"] are hardcoded for every generic/MCP tool, exactly as #32564 already diagnosed. Meanwhile tool.execute.before fires immediately before that ask() call with the real arguments — confirming a plugin-side workaround is possible (caching args by callID in tool.execute.before, then correlating on the permission.asked event) but the core UX bug for anyone not writing a plugin remains: the built-in ask dialog for any MCP tool shows only *, with no tool name or arguments, regardless of READ_ONLY_MODE/ENABLED_TOOLS settings.

As a secondary consequence also flagged in #32564: because the pattern is *, clicking Allow always on any single MCP tool call silently grants blanket approval for every MCP tool from that server — which seems like an unintended security-relevant side effect of the same bug, not just a UX one.

Happy to pick up #32564's approach (or a version of it) and resubmit as a fresh PR against dev with a linked issue and template filled out properly this time, if that's useful — just let me know.

I rerolled the PR, if you want to open another issue with the details and point to it maybe we'll manage to get it landed :)

fix(mcp): pass tool name and args to permission ask

test(mcp): assert permission ask payload from tool wrapper

fix(mcp): pass tool name and args to permission ask

test(mcp): assert permission ask payload from tool wrapper

fix(mcp): pass tool name and args to permission ask

test(mcp): assert permission ask payload from tool wrapper

Navigation Menu

Repository navigation

MCP tools show `*` instead of actual tool name in permission dialogs #19549

Bug

Example

Screenshot

Root Cause

Expected Behavior

Fix

Environment

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

MCP tools show * instead of actual tool name in permission dialogs #19549

Description

Bug

Example

Screenshot

Root Cause

Expected Behavior

Fix

Environment

Activity

mattrossman commented on Apr 9, 2026

github-actions commented on Jul 12, 2026

SamBWagner commented on Jul 24, 2026

lu-zero commented on Jul 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

MCP tools show `*` instead of actual tool name in permission dialogs #19549